Add actionlint action for workflow validation

[cosmir17]

Summary

Implements @gilescope's suggestion from PR #25 to add actionlint as an alternative to the lost scorecard/SCS functionality.

Context

In PR #25, we identified that the fork-friendly Checkmarx solution doesn't include scorecard/SCS results. Rather than trying to restore scorecard (which would require additional tokens that fork PRs don't have), Giles suggested adding actionlint for workflow validation.

What this PR adds

A new actionlint composite action that:

• Downloads and runs actionlint to validate GitHub Actions workflows
• Integrates shellcheck for shell script validation
• Integrates pyflakes for Python script validation
• Creates GitHub annotations for discovered issues
• Works with fork PRs (no special tokens required)

Usage

- name: Validate workflows
  uses: midnightntwrk/upload-sarif-github-action/actionlint@main
  with:
    fail-on-error: 'true'
    shellcheck: 'true'
    pyflakes: 'true'

Testing

• Tested locally with actionlint v1.7.7
• Verified it correctly detects:
  • Outdated action versions (e.g., actions/checkout@v2)
  • Shell script errors via shellcheck integration
  • Workflow syntax issues
• Confirmed error output format matches expected pattern for GitHub annotations
• Included comprehensive README with examples

Related

• Addresses feedback from PR feat: Add fork-friendly Checkmarx action for public repos (PM-19431) #25
• Part of PM-19431 fork-friendly security scanning solution

/cc @gilescope @mattibl

[github-actions]

Checkmarx One – Scan Summary & Details – 1002a42b-dca1-422a-8de8-0ad5d4c8cc6b

Great job! No new security vulnerabilities introduced in this pull request

[gilescope]

There's already an actionlint action - is it possible we could call out to that? https://github.com/marketplace/actions/actionlint

[cosmir17]

@gilescope Thanks for pointing that out! You're right - we should just use the existing marketplace action.

I close this PR and instead add raven-actions/actionlint@v2 directly to midnight-indexer and midnight-node workflows. That's a better approach than maintaining our own wrapper.

Will create PRs for both repos to add actionlint validation to their CI pipelines.